After the first breach, announced in June, the OPM reportedly spent more than $20 million for identity protection firm CSID to notify affected individuals and provide them with identity protection services. Government personnel, however, complained of website crashes and multi-hour call center waiting times to get basic information about affected areas and how to sign up for the 18 months of complimentary credit monitoring services that were offered.

When a second breach, announced in July, turned out to be five times bigger than the first, the government took a different approach. However, it took weeks to develop contract requirements, and the victim notification process was delayed.

“Taking this much time to notify government employees that their very confidential, personal information was stolen is extremely detrimental for two reasons,” Stu Sjouwerman, founder/CEO of the Clearwater, Fla.-based Knowbe4, said. “First, trust in our government's ability to protect data in general and in the future is badly damaged, and second, it leaves open a criminal window of opportunity to misuse this data that is way too long.”

This time around, the chosen credit monitoring firm will have to handle more than five times as many victims. Services will include a range of protection from basic credit reporting to in-depth identity monitoring, as well as identity theft insurance and a restoration program for identity theft victims.

The new contract, which provides data breach response services for three years to individuals impacted by the recent OPM incidents, also specifically requires that contractors' call center wait times do not exceed an average of 10 minutes.

The General Services Administration, Defense Department and OPM asked Naval Sea Systems Command, a division that normally deals with high-dollar contracts, to put out a request for a quote from interested bidders. The eventual contract award will be a made through an interagency collaborative process involving GSA, OPM and the Office of Management and Budget, officials said.

“As with any breach, time is of the essence, and this is no different,” Ondrej Krehel, founder/principal of the New York City-based cybersecurity intelligence firm LIFARS, explained. “The problem though, is that it could potentially be quite a while before everything is shored up, and if it even makes the deadline. This is a major problem with cybersecurity, most people take the 'I'll never be hacked' security approach. By the time they find out, they'll already be months behind and then they still have investigation and remediation to handle.”

This time frame, Krehel cautioned, can be exacerbated when no plans or existing contracts are in place, and when the breached organization has to scramble to make deals instead of acting on it right away.

“Even reactive solutions need to be put proactively in place,” he said.